---
title: Recover a Palo Alto Firewall Config with the MRT
description: When Palo Alto firewall lost its running config, I used the Maintenance Recovery Tool to extract and restore it proving resilience starts with preparation.
---

[![looking-point_LogoWhite _ Presidio-1](https://www.lookingpoint.com/hubfs/looking-point_LogoWhite%20_%20Presidio-1.svg) ![LOOKINGPOINT](https://www.lookingpoint.com/hs-fs/hubfs/Theme%20Oct%202019/images/logo@mobile.png?width=444&height=86&name=logo@mobile.png) ](https://www-lookingpoint-com.sandbox.hs-sites.com/-temporary-slug-c10ae2f5-f23e-43f2-8214-f73884fb09ae)

- [Solutions](https://www.lookingpoint.com) 
    - [Collaboration](https://www.lookingpoint.com/it-solutions-collaboration)
    - [Security ](https://www.lookingpoint.com/it-solutions-security)
    - [Networking ](https://www.lookingpoint.com/it-solutions-networking)
    - [Data Center ](https://www.lookingpoint.com/data-center)
    - [Cloud](https://www.lookingpoint.com/cloud)
    - [Managed Services](https://www.lookingpoint.com/it-support-services)
    - [Lifecycle Management](https://www.lookingpoint.com/lifecycle-management-acela)
- [Services](https://www.lookingpoint.com/en/solutions-services) 
    - [Assess and Design ](https://www.lookingpoint.com/assess-and-design-it-solutions)
    - [Deployment](https://www.lookingpoint.com/deployment-it-services-solutions)
    - [Support](https://www.lookingpoint.com/it-support-services)
    - [Wireless Surveys Assessments](https://www.lookingpoint.com/en-us/wireless-surveys-assessments)
    - [Project Management ](https://www.lookingpoint.com/project-management)
    - [Integration Center](https://www.lookingpoint.com/integration-services)
    - [Lifecycle Support](https://www.lookingpoint.com/it-lifecycle-support)
    - [Locations Serviced](https://www.lookingpoint.com/it-consulting-san-francisco-bay-area)
    - [Customer Success](https://www.lookingpoint.com/services-customer-success)
- [Partners](https://www.lookingpoint.com/partner)
- [Blog](https://www.lookingpoint.com/blog)

- [Solutions](https://www.lookingpoint.com) 
    - [Collaboration](https://www.lookingpoint.com/it-solutions-collaboration)
    - [Security ](https://www.lookingpoint.com/it-solutions-security)
    - [Networking ](https://www.lookingpoint.com/it-solutions-networking)
    - [Data Center ](https://www.lookingpoint.com/data-center)
    - [Cloud](https://www.lookingpoint.com/cloud)
    - [Managed Services](https://www.lookingpoint.com/it-support-services)
- [Services](https://www.lookingpoint.com/en/solutions-services) 
    - [Assess and Design](https://www.lookingpoint.com/assess-and-design-it-solutions)
    - [Deployment](https://www.lookingpoint.com/deployment-it-services-solutions)
    - [Support](https://www.lookingpoint.com/it-support-services)
    - [Wireless Survey Assessment](https://www.lookingpoint.com/en-us/wireless-surveys-assessments)
    - [Project Management ](https://www.lookingpoint.com/project-management)
    - [Lifecycle Management](https://www.lookingpoint.com/lifecycle-management-acela)
    - [Integration Center](https://www.lookingpoint.com/integration-services)
    - [Locations Serviced](https://www.lookingpoint.com/it-consulting-san-francisco-bay-area)
    - [Customer Success](https://www.lookingpoint.com/services-customer-success)
- [Partners](https://www.lookingpoint.com/partner)
- [Blog](https://www.lookingpoint.com/blog)
- [+1 925-566-3480](tel:+1%20925-566-3480)
- [DO NOT SHARE OR SELL MY PERSONAL INFORMATION](https://na1.hs-data-privacy.com/request/TrvvEe3VpnlESmYolHn3xw)

- [![phone@2x](https://www.lookingpoint.com/hubfs/Theme%20Oct%202019/fonts/phone@2x.png) +1 925-566-3480 ](tel:+19255663480)
- [![user@2x](https://www.lookingpoint.com/hubfs/Theme%20Oct%202019/fonts/user@2x.png) Acela Portal ](https://my.lookingpoint.com/)
- [Free Consultation](https://www.lookingpoint.com/blog/recover-a-palo-alto-firewall-config-with-the-mrt#get-free-popup)

 Let’s Connect

[Home](https://www.lookingpoint.com/) [Blog](https://www.lookingpoint.com/blog) Recover a Palo Alto Firewall Config with the MRT

# Blog

 Dec  3

Recover a Palo Alto Firewall Config with the MRT

 Posted by [Pablo Mirsoian](https://www.lookingpoint.com/blog/author/pablo-mirsoian)

[**0](https://www.lookingpoint.com/blog/recover-a-palo-alto-firewall-config-with-the-mrt#comments-listing)

** Share

- [**](https://www.facebook.com/sharer/sharer.php?u=https://www.lookingpoint.com/blog/recover-a-palo-alto-firewall-config-with-the-mrt&title=Recover%20a%20Palo%20Alto%20Firewall%20Config%20with%20the%20MRT&picture=&description=When%20Palo%20Alto%20firewall%20lost%20its%20running%20config,%20I%20used%20the%20Maintenance%20Recovery%20Tool%20to%20extract%20and%20restore%20it%20proving%20resilience%20starts%20with%20preparation.)
- [**](https://twitter.com/intent/tweet?source=https://www.lookingpoint.com/blog/recover-a-palo-alto-firewall-config-with-the-mrt&text=Recover%20a%20Palo%20Alto%20Firewall%20Config%20with%20the%20MRT)
- [**](https://plus.google.com/share?url=https://www.lookingpoint.com/blog/recover-a-palo-alto-firewall-config-with-the-mrt)
- [**](http://www.linkedin.com/shareArticle?mini=true&url=https://www.lookingpoint.com/blog/recover-a-palo-alto-firewall-config-with-the-mrt&title=Recover%20a%20Palo%20Alto%20Firewall%20Config%20with%20the%20MRT&summary=When%20Palo%20Alto%20firewall%20lost%20its%20running%20config,%20I%20used%20the%20Maintenance%20Recovery%20Tool%20to%20extract%20and%20restore%20it%20proving%20resilience%20starts%20with%20preparation.)
- [**](mailto:?subject=Recover%20a%20Palo%20Alto%20Firewall%20Config%20with%20the%20MRT&body=Recover%20a%20Palo%20Alto%20Firewall%20Config%20with%20the%20MRT%20https://www.lookingpoint.com/blog/recover-a-palo-alto-firewall-config-with-the-mrt)

[Palo Alto Networks](https://www.lookingpoint.com/blog/topic/palo-alto-networks) [network troubleshooting](https://www.lookingpoint.com/blog/topic/network-troubleshooting) [Firewall Recovery](https://www.lookingpoint.com/blog/topic/firewall-recovery) [Configuration Management](https://www.lookingpoint.com/blog/topic/configuration-management) [Cybersecurity Best Practices](https://www.lookingpoint.com/blog/topic/cybersecurity-best-practices)

 

 

I’ve always been fascinated by the quiet resilience of infrastructure — the invisible backbone that keeps businesses humming. But nothing highlights that resilience quite like an unexpected outage in the field.

**The Situation: When a Firewall Stops Handing Out IPs** 

It began with reports from a customer: users couldn’t get on the internet, and new devices weren’t receiving IP addresses. The firewall — which also served as the DHCP server — had gone silent. Connectivity dropped across multiple segments, and all signs pointed to a configuration failure or corruption within the device itself. 

From a network operations standpoint, this was more than a connectivity issue — it was a system paralysis. The Palo Alto firewall wasn’t just blocking traffic; it had seemingly lost access to its own running configuration, the file that defines how it routes, secures, and manages the network. 

With critical services offline and DHCP leases timing out, I turned to one of Palo Alto Networks’ lesser-known lifelines: the Maintenance Recovery Tool (MRT). 

**Enter the Maintenance Recovery Tool** 

Palo Alto firewalls ship with a Maintenance Recovery Tool, accessible from the boot menu. It’s a lightweight recovery environment that allows administrators to repair or extract data from a malfunctioning device. 

Accessing it required a console connection. Once connected, I rebooted the firewall and interrupted the startup sequence to select Maintenance Mode. After authenticating, the tool presented a menu of recovery options — including the one I needed most: export configuration files. 

**The Recovery Process: Extracting the Running Configuration** 

1. Console Access: I connected via the serial console cable and entered maintenance mode. 
2. Log Files Menu: From the menu, I selected “Log Files” → “Copy logs to an external location.” 
3. Export Setup: I entered the SCP server details — server IP, destination path, username, and password. (TFTP is also supported, but SCP is preferred for security.) 
4. Transfer Initiation: After confirming, the firewall created and transferred a Tech Support File named maint_logs.tar.gz to the external server. 
5. Extract the Config: Inside that archive was the live configuration file located at mgmt/saved-configs/running-config.xml. This XML contained the firewall’s entire operational setup — policies, objects, and network parameters. 

 ![Recover a Palo Alto Firewall Config with the MRT](https://www.lookingpoint.com/hs-fs/hubfs/undefined-Oct-27-2025-07-00-43-1175-PM.png?width=600&height=357&name=undefined-Oct-27-2025-07-00-43-1175-PM.png)

Figure 1 — Maintenance Recovery Tool main menu  

 ![Recover a Palo Alto Firewall Config with the MRT](https://www.lookingpoint.com/hs-fs/hubfs/undefined-Oct-27-2025-07-01-02-8477-PM.png?width=600&height=262&name=undefined-Oct-27-2025-07-01-02-8477-PM.png)

Figure 2 — Selecting the option to copy logs to an external location 

 ![Recover a Palo Alto Firewall Config with the MRT](https://www.lookingpoint.com/hs-fs/hubfs/undefined-Oct-27-2025-07-01-32-8232-PM.png?width=400&height=111&name=undefined-Oct-27-2025-07-01-32-8232-PM.png)

Figure 3 — SCP export process underway in maintenance mode 

**Lessons from the Recovery** 

What impressed me most was how thoughtfully Palo Alto Networks built its recovery environment. Even when the web interface and CLI were inaccessible, the firewall still offered a secure, structured way to recover its configuration — proof of design resilience in action. 

Key takeaways: 

- Always back up your configurations regularly, even if you rely on Panorama or automation. 

- Test your recovery process before you need it — the maintenance tool interface can be intimidating if you’ve never seen it. 

- Secure your SCP server; the Tech Support File contains sensitive system data. 

 

As always if you have any questions on getting Palo Alto Networks Recovery set up for you and your business and would like to schedule a free consultation with us, please reach out to us at [sales@lookingpoint.com](mailto:sales@lookingpoint.com) and we’ll be happy to help!

[![Contact Us](https://no-cache.hubspot.com/cta/default/2215854/7814218f-8d49-4d01-9a8c-095c00c0b08d.png)](https://cta-redirect.hubspot.com/cta/redirect/2215854/7814218f-8d49-4d01-9a8c-095c00c0b08d)

 Written By:

Pablo Mirsoian, Network Engineer

 SHARE:

- [**](https://www.facebook.com/sharer/sharer.php?u=https://www.lookingpoint.com/blog/recover-a-palo-alto-firewall-config-with-the-mrt&title=Recover%20a%20Palo%20Alto%20Firewall%20Config%20with%20the%20MRT&picture=&description=When%20Palo%20Alto%20firewall%20lost%20its%20running%20config,%20I%20used%20the%20Maintenance%20Recovery%20Tool%20to%20extract%20and%20restore%20it%20proving%20resilience%20starts%20with%20preparation.)
- [**](https://twitter.com/intent/tweet?source=https://www.lookingpoint.com/blog/recover-a-palo-alto-firewall-config-with-the-mrt&text=Recover%20a%20Palo%20Alto%20Firewall%20Config%20with%20the%20MRT)
- [**](https://plus.google.com/share?url=https://www.lookingpoint.com/blog/recover-a-palo-alto-firewall-config-with-the-mrt)
- [**](http://www.linkedin.com/shareArticle?mini=true&url=https://www.lookingpoint.com/blog/recover-a-palo-alto-firewall-config-with-the-mrt&title=Recover%20a%20Palo%20Alto%20Firewall%20Config%20with%20the%20MRT&summary=When%20Palo%20Alto%20firewall%20lost%20its%20running%20config,%20I%20used%20the%20Maintenance%20Recovery%20Tool%20to%20extract%20and%20restore%20it%20proving%20resilience%20starts%20with%20preparation.)
- [**](mailto:?subject=Recover%20a%20Palo%20Alto%20Firewall%20Config%20with%20the%20MRT&body=Recover%20a%20Palo%20Alto%20Firewall%20Config%20with%20the%20MRT%20https://www.lookingpoint.com/blog/recover-a-palo-alto-firewall-config-with-the-mrt)

### Topics

- [cisco](https://www.lookingpoint.com/blog/topic/cisco)
- [security](https://www.lookingpoint.com/blog/topic/security)
- [cybersecurity](https://www.lookingpoint.com/blog/topic/cybersecurity)
- [Cisco ISE](https://www.lookingpoint.com/blog/topic/cisco-ise)
- [collaboration](https://www.lookingpoint.com/blog/topic/collaboration)
- [ISE](https://www.lookingpoint.com/blog/topic/ise)
- [webex](https://www.lookingpoint.com/blog/topic/webex)
- [IT Solutions](https://www.lookingpoint.com/blog/topic/it-solutions)
- [cisco webex](https://www.lookingpoint.com/blog/topic/cisco-webex)
- [SD-WAN](https://www.lookingpoint.com/blog/topic/sd-wan)

### Latest Tweets **

### subscribe to our blog

## Get New Unique Posts

![looking-point_LogoWhite _ Presidio-1](https://www.lookingpoint.com/hubfs/looking-point_LogoWhite%20_%20Presidio-1.svg)

 391 Taylor Blvd. Suite 120 Pleasant Hill, California 94523

[Call Us +1 925-566-3480](tel:+19255663480)

[sales@lookingpoint.com](mailto:sales@lookingpoint.com)

- [**](https://www.facebook.com/lookingpoint?fref=ts)
- [**](https://twitter.com/lookingpoint)
- [**](https://www.linkedin.com/company/lookingpoint)
- [**](https://www.instagram.com/lookingpoint/)

 SOLUTIONS

- [Collaboration](https://www.lookingpoint.com/it-solutions-collaboration)
- [ Security](https://www.lookingpoint.com/it-solutions-security)
- [Networking ](https://www.lookingpoint.com/it-solutions-networking)
- [Cloud](https://www.lookingpoint.com/cloud)
- [Data Center ](https://www.lookingpoint.com/data-center)
- [Project Management ](https://www.lookingpoint.com/project-management)
- [Lifecycle Management](https://www.lookingpoint.com/lifecycle-management-acela)
- [Wireless Surveys Assessments](https://www.lookingpoint.com/en-us/wireless-surveys-assessments)

 MANAGED SERVICES

- [Assess and Design](https://www.lookingpoint.com/assess-and-design-it-solutions)
- [Deployment](https://www.lookingpoint.com/deployment-it-services-solutions)
- [Support](https://www.lookingpoint.com/it-support-services)
- [Integration Center](https://www.lookingpoint.com/integration-services)
- [Lifecycle Support](https://www.lookingpoint.com/it-lifecycle-support)
- [Locations Serviced](https://www.lookingpoint.com/it-consulting-san-francisco-bay-area)
- [Customer Success](https://www.lookingpoint.com/services-customer-success)

 COMPANY

- [Contact Us](https://www.lookingpoint.com/contact-us)
- [Career](https://www.lookingpoint.com/career)
- [About Us](https://www.lookingpoint.com/about-us)
- [ FAQ](https://www.lookingpoint.com/faq)
- [ Partners](https://www.lookingpoint.com/partner)
- [Blog](https://www.lookingpoint.com/blog)
- [Privacy Policy](https://www.lookingpoint.com/privacy-policy)
- [DO NOT SELL OR SHARE MY PERSONAL INFORMATION](https://na1.hs-data-privacy.com/request/TrvvEe3VpnlESmYolHn3xw)

 GET IN TOUCH

 Join our mailing list to stay up to date and get notices about our new releases!

 Looking Point Inc. 2026

 Cookie Settings